diff --git a/meta/recipes-core/util-linux/util-linux-libuuid_2.42.2.bb b/meta/recipes-core/util-linux/util-linux-libuuid_2.42.3.bb similarity index 100% rename from meta/recipes-core/util-linux/util-linux-libuuid_2.42.2.bb rename to meta/recipes-core/util-linux/util-linux-libuuid_2.42.3.bb diff --git a/meta/recipes-core/util-linux/util-linux.inc b/meta/recipes-core/util-linux/util-linux.inc index ee9291fb4f..20b0c37e8c 100644 --- a/meta/recipes-core/util-linux/util-linux.inc +++ b/meta/recipes-core/util-linux/util-linux.inc @@ -17,9 +17,14 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/util-linux/v${MAJOR_VERSION}/util-lin file://display_testname_for_subtest.patch \ file://avoid_parallel_tests.patch \ file://0001-tests-script-Disable-size-option-test.patch \ + file://0001-libmount-add-missing-fileutils.h-include-to-hook_idma.patch \ + file://0002-lib-fileutils-fix-unused-parameter-warnings-without-.patch \ + file://0003-mount-fix-grammar-and-typo-in-X-mount.idmap-document.patch \ + file://0004-libmount-use-USE_LIBMOUNT_MOUNTFD_SUPPORT-for-idmap-h.patch \ + file://0005-tools-add-non-newmount.conf-config-gen-profile.patch \ " -SRC_URI[sha256sum] = "03a05d3adf9602ef128f2da05b84b3205ce60c351e5737c0370f74000679ce8a" +SRC_URI[sha256sum] = "66ac7c0e725278eb2b039e3104f2c91119341d941b41bac7a285c695f940bd57" CVE_PRODUCT = "util-linux" diff --git a/meta/recipes-core/util-linux/util-linux/0001-libmount-add-missing-fileutils.h-include-to-hook_idma.patch b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-missing-fileutils.h-include-to-hook_idma.patch new file mode 100644 index 0000000000..cb20c60c9d --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0001-libmount-add-missing-fileutils.h-include-to-hook_idma.patch @@ -0,0 +1,36 @@ +From 92369ef3fe1bcc48548441b68fb17786500c2bc3 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 2 Sep 2026 13:32:27 +0200 +Subject: [PATCH] libmount: add missing fileutils.h include to hook_idmap.c + +The hook_idmap.c uses RESOLVE_NO_SYMLINKS (added by commit fb8e26535) +but does not include fileutils.h, which provides the fallback #define +for this constant. + +On Fedora (glibc 2.40+), this is masked because glibc's + transitively includes , which +defines RESOLVE_NO_SYMLINKS. On Ubuntu (and other distros with older +glibc), does not pull in openat2.h, so the build fails: + + hook_idmap.c:335:33: error: 'RESOLVE_NO_SYMLINKS' undeclared + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/7e2e010874b10b3aabdc3c4c844c9ffc46a4a374] +Signed-off-by: Jaipaul Cheernam +--- + libmount/src/hook_idmap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index 77494e2..2c697b1 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -23,6 +23,7 @@ + + #include "strutils.h" + #include "all-io.h" ++#include "fileutils.h" + #include "namespace.h" + + #include "mountP.h" diff --git a/meta/recipes-core/util-linux/util-linux/0001-tests-script-Disable-size-option-test.patch b/meta/recipes-core/util-linux/util-linux/0001-tests-script-Disable-size-option-test.patch index 924c8c6827..a70d038cee 100644 --- a/meta/recipes-core/util-linux/util-linux/0001-tests-script-Disable-size-option-test.patch +++ b/meta/recipes-core/util-linux/util-linux/0001-tests-script-Disable-size-option-test.patch @@ -1,4 +1,4 @@ -From 078231e4ecb5fa12107cd463f42e4c63ef3ff15c Mon Sep 17 00:00:00 2001 +From c83f9dbfd7d9b96e4969ab16d5db69e064c67c50 Mon Sep 17 00:00:00 2001 From: Paul Barker Date: Mon, 5 Jan 2026 09:56:41 +0000 Subject: [PATCH] tests: script: Disable size option test diff --git a/meta/recipes-core/util-linux/util-linux/0002-lib-fileutils-fix-unused-parameter-warnings-without-.patch b/meta/recipes-core/util-linux/util-linux/0002-lib-fileutils-fix-unused-parameter-warnings-without-.patch new file mode 100644 index 0000000000..ff6577e7e8 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0002-lib-fileutils-fix-unused-parameter-warnings-without-.patch @@ -0,0 +1,66 @@ +From 95eb4a92ab0bd10e890783b8bc0794b2fb1cf438 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 09:45:29 +0200 +Subject: [PATCH] lib/fileutils: fix unused parameter warnings without +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + + SYS_openat2 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On systems without SYS_openat2 (older kernels), ul_openat_resolve() +is a stub that returns -ENOSYS, making all parameters unused. With +-Werror=unused-parameter this breaks the build. + +Move the #ifdef around the whole function so each branch has its own +declaration — the SYS_openat2 branch uses all parameters normally, +the fallback branch marks them __unused__. + +Fixes: fb8e26535 ("libmount: pin source path with openat2() for restricted users") +Signed-off-by: Karel Zak +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/a471b62e732a491f1abe42450352fb0f9b5b43ea] +Signed-off-by: Jaipaul Cheernam +--- + lib/fileutils.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/lib/fileutils.c b/lib/fileutils.c +index 89f1e21..80b69ee 100644 +--- a/lib/fileutils.c ++++ b/lib/fileutils.c +@@ -440,10 +440,10 @@ char *ul_basename(char *path) + return p; + } + ++#if defined(SYS_openat2) + int ul_openat_resolve(int dirfd, const char *path, int flags, + mode_t mode, unsigned long long resolve) + { +-#if defined(SYS_openat2) + struct open_how how = { + .flags = (__u64) flags, + .mode = (__u64) mode, +@@ -451,11 +451,19 @@ int ul_openat_resolve(int dirfd, const char *path, int flags, + }; + + return syscall(SYS_openat2, dirfd, path, &how, sizeof(how)); ++} + #else ++int ul_openat_resolve( ++ int dirfd __attribute__((__unused__)), ++ const char *path __attribute__((__unused__)), ++ int flags __attribute__((__unused__)), ++ mode_t mode __attribute__((__unused__)), ++ unsigned long long resolve __attribute__((__unused__))) ++{ + errno = ENOSYS; + return -1; +-#endif + } ++#endif + + int ul_open_no_symlinks(const char *path, int flags, mode_t mode) + { diff --git a/meta/recipes-core/util-linux/util-linux/0003-mount-fix-grammar-and-typo-in-X-mount.idmap-document.patch b/meta/recipes-core/util-linux/util-linux/0003-mount-fix-grammar-and-typo-in-X-mount.idmap-document.patch new file mode 100644 index 0000000000..db4fca57b6 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0003-mount-fix-grammar-and-typo-in-X-mount.idmap-document.patch @@ -0,0 +1,48 @@ +From 410c4db19325ed9b1aa7aacbc34f657de9f906d3 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Wed, 8 Jul 2026 14:03:43 +0200 +Subject: [PATCH] mount: fix grammar and typo in X-mount.idmap documentation + +Apply grammar improvements from PR #4400 (field order change +intentionally omitted as the current order matches the code). +Also fix a GUID -> GID typo in the example. + +Signed-off-by: Karel Zak +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b38324a9a4020123e8972079de51a2aed7e44c69] +Signed-off-by: Jaipaul Cheernam +--- + sys-utils/mount.8.adoc | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc +index 8a6e09f..71daf92 100644 +--- a/sys-utils/mount.8.adoc ++++ b/sys-utils/mount.8.adoc +@@ -826,8 +826,8 @@ Set _mountpoint_'s mode after mounting. + + *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__:: + Use this option to create an idmapped mount. +-An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace. +-The ownership change is tied to the lifetime and localized to the relevant mount. ++An idmapped mount allows the ownership of all files located under a mount to be changed according to the ID-mapping associated with a user namespace. ++The ownership change is tied to the lifetime of, and localized to, the relevant mount. + The relevant ID-mapping can be specified in two ways: + + + * A user can specify the ID-mapping directly. +@@ -842,13 +842,13 @@ It is possible to specify multiple ID-mappings. + The individual ID mappings must be separated by spaces. Please note that in the __/etc/fstab__ file, spaces are interpreted as separators between fields. To avoid this, you must escape them using \040. For example, X-mount.idmap=0:0:1\040500:1000:1. + + + For example, the ID-mapping *X-mount.idmap=u:1000:0:1 g:1001:1:2 5000:1000:2* creates an idmapped mount where +-UID 0 is mapped to UID 1000, GID 1 is mapped to GUID 1001, GID 2 is mapped to GID 1002, UID and GID 1000 are mapped to 5000, and UID and GID 1001 are mapped to 5001 in the mount. ++UID 0 is mapped to UID 1000, GID 1 is mapped to GID 1001, GID 2 is mapped to GID 1002, UID and GID 1000 are mapped to 5000, and UID and GID 1001 are mapped to 5001 in the mount. + + +-When an ID-mapping is specified directly a new user namespace will be allocated with the requested ID-mapping. ++When an ID-mapping is specified directly, a new user namespace will be allocated with the requested ID-mapping. + The newly created user namespace will be attached to the mount. + * A user can specify a user namespace file. + + +-The user namespace will then be attached to the mount and the ID-mapping of the user namespace will become the ID-mapping of the mount. ++The user namespace will then be attached to the mount, and the ID-mapping of the user namespace will become the ID-mapping of the mount. + + + For example, *X-mount.idmap=/proc/PID/ns/user* will attach the user namespace of the process PID to the mount. + diff --git a/meta/recipes-core/util-linux/util-linux/0004-libmount-use-USE_LIBMOUNT_MOUNTFD_SUPPORT-for-idmap-h.patch b/meta/recipes-core/util-linux/util-linux/0004-libmount-use-USE_LIBMOUNT_MOUNTFD_SUPPORT-for-idmap-h.patch new file mode 100644 index 0000000000..623783b35c --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0004-libmount-use-USE_LIBMOUNT_MOUNTFD_SUPPORT-for-idmap-h.patch @@ -0,0 +1,112 @@ +From cd5780da58af24a07b033da1ebbb53005fb14fc8 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 10:01:29 +0200 +Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook + +The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel +headers have the new mount syscalls) rather than +USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support). + +This was intentional (commit 9040c0900, 2022) -- the idea was to keep +idmap working even with --disable-libmount-mountfd-support by calling +the raw open_tree() syscall directly, while using an inner #ifdef +USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree. + +This fine-grained approach broke when the CVE-2026-78410 fix replaced +the raw open_tree() call with mnt_open_tree(), which is only available +under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with +--disable-libmount-mountfd-support because mnt_open_tree() is +undeclared. + +Rather than maintaining two code paths for a feature that fundamentally +depends on the new mount API, gate the entire idmap hookset on +USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is +guarded. Remove the now-redundant inner #ifdef. + +Also add a note to mount.8 that X-mount.idmap requires the new +fd-based mount API. + +Addresses: https://github.com/util-linux/util-linux/issues/4598 +Signed-off-by: Karel Zak +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/e06799ac325a881a297d2ffd6fe568cacdcd00ab] +Signed-off-by: Jaipaul Cheernam +--- + libmount/src/hook_idmap.c | 6 ++---- + libmount/src/hooks.c | 2 +- + libmount/src/version.c | 2 +- + sys-utils/mount.8.adoc | 1 + + 4 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c +index 2c697b1..b1477ac 100644 +--- a/libmount/src/hook_idmap.c ++++ b/libmount/src/hook_idmap.c +@@ -32,7 +32,7 @@ + # include + #endif + +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + + typedef enum idmap_type_t { + ID_TYPE_UID, /* uidmap entry */ +@@ -317,7 +317,6 @@ static int hook_mount_post( + * Once a mount has been attached to the filesystem it can't be + * idmapped anymore. So create a new detached mount. + */ +-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + { + struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt); + +@@ -327,7 +326,6 @@ static int hook_mount_post( + DBG(HOOK, ul_debugobj(hs, " reuse tree FD")); + } + } +-#endif + if (fd_tree < 0) + fd_tree = mnt_open_tree(AT_FDCWD, target, + OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC | +@@ -544,4 +542,4 @@ const struct libmnt_hookset hookset_idmap = + .deinit = hookset_deinit + }; + +-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */ ++#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */ +diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c +index 23eca4e..5ae91ed 100644 +--- a/libmount/src/hooks.c ++++ b/libmount/src/hooks.c +@@ -45,7 +45,7 @@ static const struct libmnt_hookset *const hooksets[] = + &hookset_mount, + #endif + &hookset_mount_legacy, +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + &hookset_idmap, + #endif + &hookset_owner +diff --git a/libmount/src/version.c b/libmount/src/version.c +index 5ec0d49..30cb340 100644 +--- a/libmount/src/version.c ++++ b/libmount/src/version.c +@@ -37,7 +37,7 @@ static const char *lib_features[] = { + #ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES + "namespaces", + #endif +-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) ++#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT + "idmapping", + #endif + #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT +diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc +index 71daf92..c2b095a 100644 +--- a/sys-utils/mount.8.adoc ++++ b/sys-utils/mount.8.adoc +@@ -826,6 +826,7 @@ Set _mountpoint_'s mode after mounting. + + *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__:: + Use this option to create an idmapped mount. ++This feature requires the new file-descriptor-based mount API (available since Linux 5.2). + An idmapped mount allows the ownership of all files located under a mount to be changed according to the ID-mapping associated with a user namespace. + The ownership change is tied to the lifetime of, and localized to, the relevant mount. + The relevant ID-mapping can be specified in two ways: diff --git a/meta/recipes-core/util-linux/util-linux/0005-tools-add-non-newmount.conf-config-gen-profile.patch b/meta/recipes-core/util-linux/util-linux/0005-tools-add-non-newmount.conf-config-gen-profile.patch new file mode 100644 index 0000000000..4a957489b1 --- /dev/null +++ b/meta/recipes-core/util-linux/util-linux/0005-tools-add-non-newmount.conf-config-gen-profile.patch @@ -0,0 +1,26 @@ +From 19b732395c1c7dc849823a3aa0d8a66122483f54 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 3 Sep 2026 10:15:43 +0200 +Subject: [PATCH] tools: add non-newmount.conf config-gen profile + +Add a configuration profile to test builds with +--disable-libmount-mountfd-support, useful for verifying that libmount +compiles without the new fd-based mount API. + +Signed-off-by: Karel Zak +Upstream-Status: Backport [https://github.com/util-linux/util-linux/commit/b8159405b99af7af2054f9f8222cf23901368a01] +Signed-off-by: Jaipaul Cheernam +--- + tools/config-gen.d/non-newmount.conf | 3 +++ + 1 file changed, 3 insertions(+) + create mode 100644 tools/config-gen.d/non-newmount.conf + +diff --git a/tools/config-gen.d/non-newmount.conf b/tools/config-gen.d/non-newmount.conf +new file mode 100644 +index 0000000..303b6cb +--- /dev/null ++++ b/tools/config-gen.d/non-newmount.conf +@@ -0,0 +1,3 @@ ++include:core.conf ++ ++--disable-libmount-mountfd-support diff --git a/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch b/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch index 44a8d768d2..9b94cbf1c1 100644 --- a/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch +++ b/meta/recipes-core/util-linux/util-linux/avoid_parallel_tests.patch @@ -1,4 +1,4 @@ -From 4303ca5212f78fa276be750e077303f5090b7e33 Mon Sep 17 00:00:00 2001 +From dde7b7ff56ed406ef96b975b88b6ab663fd10386 Mon Sep 17 00:00:00 2001 From: Tudor Florea Date: Mon, 14 Jun 2021 14:00:31 +0200 Subject: [PATCH] util-linux: Add ptest @@ -14,7 +14,7 @@ Upstream-Status: Inappropriate 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index e2061e7..f816656 100644 +index ea3875e..9e0377e 100644 --- a/configure.ac +++ b/configure.ac @@ -11,7 +11,7 @@ AC_CONFIG_MACRO_DIR([m4]) diff --git a/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch b/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch index 6d50cfd2c0..1c338126bf 100644 --- a/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch +++ b/meta/recipes-core/util-linux/util-linux/configure-sbindir.patch @@ -1,4 +1,4 @@ -From d91f680b43b0c70ee7c4f3b74996c342ca15129e Mon Sep 17 00:00:00 2001 +From 5981a174707a384d6970c7ce7d8d68322985a6fa Mon Sep 17 00:00:00 2001 From: Phil Blundell Date: Mon, 24 Sep 2012 07:24:51 +0100 Subject: [PATCH] util-linux: Ensure that ${sbindir} is respected @@ -14,7 +14,7 @@ Upstream-Status: Inappropriate [configuration] 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 13bed69..e2061e7 100644 +index 50ed64d..ea3875e 100644 --- a/configure.ac +++ b/configure.ac @@ -110,7 +110,10 @@ AC_SUBST([runstatedir]) diff --git a/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch b/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch index 1382e10c30..6ffcf46295 100644 --- a/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch +++ b/meta/recipes-core/util-linux/util-linux/display_testname_for_subtest.patch @@ -1,4 +1,4 @@ -From 42cfda0aa633f3a6786be1e490202cc9fe89e4e5 Mon Sep 17 00:00:00 2001 +From caadbbf29cfeeaac301d02185e717a5587a9cdf8 Mon Sep 17 00:00:00 2001 From: Tudor Florea Date: Thu, 3 Dec 2015 04:08:00 +0100 Subject: [PATCH] Display testname for subtest diff --git a/meta/recipes-core/util-linux/util-linux/ptest.patch b/meta/recipes-core/util-linux/util-linux/ptest.patch index 3c529f2ea5..1fec138c3a 100644 --- a/meta/recipes-core/util-linux/util-linux/ptest.patch +++ b/meta/recipes-core/util-linux/util-linux/ptest.patch @@ -1,4 +1,4 @@ -From 238020ed859acb41f1f43352afc28db14cecb34e Mon Sep 17 00:00:00 2001 +From 368d04b58ce8b52e93d33be1321e78a9c6bf80ae Mon Sep 17 00:00:00 2001 From: Tudor Florea Date: Thu, 3 Dec 2015 04:08:00 +0100 Subject: [PATCH] Define TESTS variable diff --git a/meta/recipes-core/util-linux/util-linux_2.42.2.bb b/meta/recipes-core/util-linux/util-linux_2.42.3.bb similarity index 100% rename from meta/recipes-core/util-linux/util-linux_2.42.2.bb rename to meta/recipes-core/util-linux/util-linux_2.42.3.bb